CVE-2026-72060

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: icssg: guard PA stat lookups

icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name()

with FW PA stat names regardless of whether the PA stats block is

present on the hardware. emac_get_stat_by_name() already guards the

PA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer

is NULL the lookup falls through to netdev_err() and returns -EINVAL.

Because ndo_get_stats64 is polled regularly by the networking stack

this produces thousands of log entries of the form:

icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR

A secondary consequence is that the int(-EINVAL) return value is

implicitly widened to a near-ULLONG_MAX unsigned value when accumulated

into the __u64 fields of rtnl_link_stats64, silently corrupting the

rx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`.

Every other PA-aware code path in the driver is already guarded with

the same `

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References